89a47fb1ac30450d781d87fd274254636c31cd640ae34a3c77310cdc45bdf56c

Analysis

max time kernel
137s
max time network
138s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

687174f4dce25c3598221afd801736ef_JaffaCakes118.html
Size

5KB
MD5

687174f4dce25c3598221afd801736ef
SHA1

fb094abdb80a78e9abcd2ccb31c3ef13f193add3
SHA256

89a47fb1ac30450d781d87fd274254636c31cd640ae34a3c77310cdc45bdf56c
SHA512

f0f1cc71507767cebeab8bc194c4a948f4baf71456c20a3fcc8ef3fd09228d05151be4170a81993b087fb86fd57484b6497532a1f28e10a278d3a4e17f44ad14
SSDEEP

96:9bVZp3KyHfBQPXRrihUbWlIXByyfH7qxkM:9htHfqvxi+TX0kHFM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{28E72051-1876-11EF-B587-FED6C5E8D4AB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000003268e40fc41f057e2b8a71aff98d5e8403adb400333f9cafa571ca813b3e3a0a000000000e80000000020000200000000f7ebce95203a6f64fc537135fc25fe4feba206829fe4c782684ffe45905be6320000000636be3186899e37a1e3e5f6a6240fcd40febef547dd535f6cc8eb8c365bfcb0a40000000091651180335d0d38484f1b54bc715e03cfe067478dc1e20afb356db8134604ca77b21c7f06f8a301953c8dc804fc3a7b3c86c5cef0a1daf8ea9feb6c93d9cb1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0f56ffd82acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000f5366e5e103a17bde6d41f0eb0980c3424164cf64cc318f709b940a8f3411178000000000e8000000002000020000000b9f6b42fe7f6dd82eb6c9611a550742e0fc91d9731e88f659f92cf045790c0eb900000009c7f1a7c0995c796c75cc5d67d1ade3a19f3714398fc0aa9c89dda8f80cef7c149402cc8c4e1b1a2fe66fbc7e5bb0a89a32d9f49609b328e2db6df0cedfff783e507fc418cc8f5ffa885a037c43638ec0a931e9cf228f7f1012acd3e178d8f09069889d1ccab73b0b8a945cf92b83f6d82581ece9efcc911a19f333fbabe0df458c0c17a34b569f75b4270ba03e052f540000000f9d67c7abfca0195f1e265d3a245d8a2a925549c74ec8a0ba66539f46049f6b9b092241f94017e7c1662abfbdf30e6c320aa17309181d78c40658956b17ca15c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422570021"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1240 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1240 iexplore.exe
1240 iexplore.exe
1872 IEXPLORE.EXE
1872 IEXPLORE.EXE
1872 IEXPLORE.EXE
1872 IEXPLORE.EXE

pid	process
1240	iexplore.exe

pid	process
1240	iexplore.exe
1240	iexplore.exe
1872	IEXPLORE.EXE
1872	IEXPLORE.EXE
1872	IEXPLORE.EXE
1872	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1240 wrote to memory of 1872	1240	iexplore.exe	IEXPLORE.EXE
PID 1240 wrote to memory of 1872	1240	iexplore.exe	IEXPLORE.EXE
PID 1240 wrote to memory of 1872	1240	iexplore.exe	IEXPLORE.EXE
PID 1240 wrote to memory of 1872	1240	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\687174f4dce25c3598221afd801736ef_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1240 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1872

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
05e97f9043a5511506d8fb102af8df04

SHA1
c5efe93f5004b52f8e81e112cc4f5207a7828ae6

SHA256
3c4be0c8142e004a8488a339a36cacb88c31612567da599a45350cbe9496a6a9

SHA512
9d54a641e38d10f7e74d6c6e9899161de0a22c4e7707691202d80f70a5361f12dd73b3a42c351ad2189820a077502367407680b4a885a5c5eb61219243a2187e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b9e4741538ac68f68943fa0fbc10f2d5

SHA1
55be30e9eeb466d1ff5af8c7e0ad722f908ab971

SHA256
042e21a96620981012b985e435874107d90dfc6f1bf707f67afb8d14d5fdbe8e

SHA512
a110671662598aa883edf1e6810ba1a6cf1b30a5d25bb70a9554851c796c2c656d40495826e872e36ce19879c9ed02a5a3cae7b0b594fe8e31c0495a3a295168

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
62096d596212c46dd9f67d79f23b8607

SHA1
67a9f166239d716dc840ec20d2034614dccc8083

SHA256
fc39672085b851d58842a11d6cf58a68d514e372e216018d60bf7b21c4eea1cb

SHA512
e2b9cbd83d04e53f7299481add8385c5eb92432fe8d187fe6a72777e8dc8708f2fbd5b717ede6c31994974a0b8b078ec5986127c36cfe533c62e8049c337f61a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
50e8e3e519ff5a6c8c828ea89acf1fc7

SHA1
38a3e54a0dd95ca9d64769d633ed457b3d880a66

SHA256
189d56f0c563999001f963c0fd30a008c3985e90e8ba74e4c1ac52975c8e5d32

SHA512
48ea0e2689d260641e721acbf2adbb3548db76999a7761662ebaf11c542cb5a8dfbdd929b2e5ff1faca7693c07c20d2c347f8c3fe75f50912c3afe38f554d298

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
66540f6110a1dc555229d370aaf05758

SHA1
b4edb19f0bb18b754c493c859b7fb9e7c2f3b47d

SHA256
b9d0c34f5f2ac5c441356af280792f7794410023b40fcee77cf2729dab7fc0cc

SHA512
28402e8dd2e87be991ca387f1b3339e0649addb4bf1ab0eda6ff1b213e6339e2da209e037fec49072c378e7db4d1cc258e0daf720215a0c769d93386274636e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
9433c3272f9287e996bbb21e9bcdbdd0

SHA1
60c265591d070d1cad992e5d59bf9a02b8a991e2

SHA256
7f13630dd02565ff21817d7d645b06e332388e84f87dafbc33e1a04ad048f31a

SHA512
b03cc1c66b9a1c5e0600b9fab388b1e2002caeaf2bebac36874db913f00234b762298a2031690442044fd80edbc77b6fe16305adfd5f4826e26a95e81ffbaf0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
2edb661930242b7d62dd7012989fbf42

SHA1
8f046e2328e234a3d44b79f7f7792a6121d9630d

SHA256
add5be6347fa8f4e24625c9cfa39e19ff47697eb1ca246382126a9029ef26417

SHA512
4a83cfb78f1c4ac2fc27d2011a02d1779ef016657e8287a7a2031bd86f2dac35bb5cdd3ab3baf34c02dee7f0bed55f326a332a26a01568a65d6de4e06b4a95e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1fe1f7630ed0a665f6438e269db61e8e

SHA1
ce58d4c59388e41ce678eda37438adac5a2d4c82

SHA256
668f0cea26d3e5dec44630b1128b0ecba8ef922866328c2542a440a8d68fa1ef

SHA512
d0df10b62488177a965c0b129ad76f8db542a95c4ab3c2710928ed6ed78b80320641c022649f8e7de8bf7139014fcd46709ac9b0ab916684538dfcc6350d818a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
93d0d384a8a12932c2b2065c10465a97

SHA1
3da5f7296334c42e0e404854de5536eda16ccecd

SHA256
605d2e085c23f004ce3b775d373d8a1e707c912dcf1d112acb3d185c5db84823

SHA512
98ba68e131317300392c4292f7b7e46b119089c9fe644e3a6a49618c1853cd4d5cd9b775d6c0479f9e2a7b7d7484406ea3294aeeb7addcabeb70b38925a050c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b3beea0d7069a32ca9f728c3ac063854

SHA1
81fee56c2cc83ac1bb3d506c9ce6246d02b9f786

SHA256
06994a0248dd56d40308a50b85492d3bc883a850be96aa272ce05c4c6ff6de94

SHA512
ff473805b7a0652dedc12440aadac545724b9d07ced13c0bd4c28e7646b57b06b25795bc268ba481b3abca89806f5e67b54da46d7e4fb061d80721f8de057424

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
26e8fb75eacef71a4df46506ffa6254c

SHA1
96ba4a879db0bf2059e51f7f368e2b613a4d2ad9

SHA256
13e1dde979f3bb18b07c3d02496bc033ca71f9aa2da088ff9ed9a845fa07a6ec

SHA512
ba8ffdaffed98248c20e386e6088372c2b421c7143c43b815caa64fcbdf0048655d0a52eca18a3368b77d723dd7dc902525c40643f81941595fec9bf1301830b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
d7a930b1e7bd54208b4b877ec9aa18a9

SHA1
f076e245dd53919be786b13acf4abc97220a6444

SHA256
86253d8fc99768dd44429db2bd883720dcad4ddf7c58b498fe5be3109611b87f

SHA512
74b0de1098c2df7dca8d1252f7f7a445336306ca90a73bc0774de1f1f1c93d9f270bfd39c37ee8605f9eac929218b80790e552e2d2b954922ccc0a1cc40e503e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
7b20d12d74279b6e6cc60df2332ffff6

SHA1
5c7ef3dab7d58a0927ab15ffd200efed97614292

SHA256
a53bc9e2ce1e9b9393250d44a8e8f3c6dc8696282e7548c8fa154703f55c257b

SHA512
0e40f1ac108a8c813f844a7c4a2c2c86fce2da33008a1427790dd4c2e802f212f8d5f73ba7e5c1c59944bbfe58c7aa927d5d7562cd60e5b61d2f9da7463daa7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b978dc2002a2b636cd1652f65a9db15a

SHA1
97f4b20675a316c6eef84fda97e80263fbfb231e

SHA256
3bf1d0519ca06fd3237cd82956dddd1db5fbfef29be1ce2abf65737953dd39ad

SHA512
39eea050fe0c5479842118cf6a7589a2ecd3c017380f33638e89d72cc4d194011ba9f072f62af09eedbf2346a5ecbf97d7409cc067e74ce0fe3649d4c7834426

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4867.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar48FA.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit